smoodly 0.0.50 → 0.0.52

package/dist/admin/forms/upload.js

@@ -1,33 +1,71 @@
-import { MEDIA_CACHE_SECONDS } from "../../media.js";
+// The browser half of an upload (spec 2026-10-18 media on R2 and Images §4): the browser measures the file, then
+// sends it in one request to the service's admin media route, the bytes as the body and the rest as query
+// parameters; the service streams it into the bucket and answers the ready asset. A video's poster frame is uploaded
+// first as its own image asset and linked. The send and the measure are injected so the flow is testable without a
+// DOM.
+import { ASSET_REFUSED, assertMediaRules, isAssetRefused } from "../../asset-store.js";
 const stem = (name) => name.replace(/\.[^.]+$/, "");
-export async function uploadFile(ops, file, deps) {
-    const begun = await ops.beginUpload({ name: file.name, mime: file.type, size: file.size });
-    if (!begun.ok)
-        return begun;
-    try {
-        await deps.put(begun.data.uploadUrl, file, file.type);
-    }
-    catch (e) {
-        return { ok: false, code: "internal", message: `smoodly: upload failed — ${e instanceof Error ? e.message : String(e)}` };
-    }
-    const m = await deps.measure(file, file.type);
+export async function uploadFile(send, file, measure, onProgress) {
+    const m = await measure(file, file.type);
     let posterId;
     if (m.poster) {
-        const poster = await uploadFile(ops, new File([m.poster], `${stem(file.name)}-poster.jpg`, { type: "image/jpeg" }), deps);
+        const poster = await uploadFile(send, new File([m.poster], `${stem(file.name)}-poster.jpg`, { type: "image/jpeg" }), measure);
         if (poster.ok)
             posterId = poster.data.id;
     }
-    return ops.finishUpload(begun.data.id, { width: m.width, height: m.height, duration: m.duration, posterId });
+    const params = { name: file.name, mime: file.type };
+    for (const [key, value] of Object.entries({ width: m.width, height: m.height, duration: m.duration, posterId })) {
+        if (value !== undefined)
+            params[key] = String(value);
+    }
+    return send(file, params, onProgress);
+}
+export const uploadQuery = (params) => new URLSearchParams(params).toString();
+/** A send that first applies the space's media rules (its registry's `media`) with the store's own words, so a file
+ *  the space refuses is never sent; the service checks again, and its word is final. */
+export function checkedSend(send, rules) {
+    return async (file, params, onProgress) => {
+        try {
+            assertMediaRules(rules, { filename: params.name, mime: params.mime, size: file.size });
+        }
+        catch (e) {
+            if (isAssetRefused(e))
+                return { ok: false, code: "validation", message: e.message.slice(ASSET_REFUSED.length).trim() };
+            throw e;
+        }
+        return send(file, params, onProgress);
+    };
 }
-/** A raw PUT to the signed URL: the body is the file, the type its mime,
- *  and the year-long cache-control Storage serves back (without the
- *  header a signed upload lands as `no-cache`). */
-export async function putSigned(url, file, mime) {
-    const res = await fetch(url, {
-        method: "PUT",
-        headers: { "content-type": mime, "x-upsert": "false", "cache-control": `max-age=${MEDIA_CACHE_SECONDS}` },
-        body: file,
+const failed = (message) => ({ ok: false, code: "internal", message });
+/** The admin's send: an XMLHttpRequest PUT (fetch reports no upload progress) to the admin media route with the
+ *  editor's pass. A pass refused as expired renews once and the file is sent again, as an operation is
+ *  (client-ops.ts). */
+export function xhrSend(url, token, onExpired) {
+    const once = (file, params, onProgress) => new Promise((resolve) => {
+        const xhr = new XMLHttpRequest();
+        xhr.open("PUT", `${url}?${uploadQuery(params)}`);
+        const t = token();
+        if (t)
+            xhr.setRequestHeader("authorization", `Bearer ${t}`);
+        xhr.setRequestHeader("content-type", params.mime || "application/octet-stream");
+        xhr.upload.onprogress = (e) => { if (e.lengthComputable && e.total > 0)
+            onProgress?.(e.loaded / e.total); };
+        xhr.onload = () => {
+            try {
+                const body = JSON.parse(xhr.responseText);
+                if (typeof body === "object" && body !== null && typeof body.ok === "boolean")
+                    return resolve(body);
+            }
+            catch { /* answered below */ }
+            resolve(failed(`smoodly: the upload answered ${xhr.status} without a result — see the service's log.`));
+        };
+        xhr.onerror = () => resolve(failed("smoodly: the upload did not reach the service — check the connection and try again."));
+        xhr.send(file);
     });
-    if (!res.ok)
-        throw new Error(`${res.status} ${(await res.text()).slice(0, 200)}`);
+    return async (file, params, onProgress) => {
+        const r = await once(file, params, onProgress);
+        if (r.ok || !r.expired)
+            return r;
+        return (await onExpired?.()) === true ? once(file, params, onProgress) : r;
+    };
 }

package/dist/admin/global-items.d.ts

@@ -1,9 +1,6 @@
-import type { ResolvedConfig } from "../config.ts";
 import type { Descriptor } from "../fields.ts";
-import type { EntryRecord, EntryStore } from "../entry-store.ts";
 import { type GlobalSchema } from "../global.ts";
 /** The merged fields a fresh item starts from: sampled field values, and
  *  for a visual item `$settings` = the section's settings defaults with the
  *  sample's settings values on top. Unsampled fields stay absent. */
 export declare function initialGlobalFields(item: GlobalSchema, settingsDescriptors: Record<string, Descriptor>): Record<string, unknown>;
-export declare function ensureGlobalItems(entries: EntryStore, config: ResolvedConfig): Promise<Record<string, EntryRecord>>;

package/dist/admin/global-items.js

@@ -1,5 +1,4 @@
 import { SETTINGS_KEY } from "../global.js";
-import { sectionSettings } from "./serialize.js";
 /** The merged fields a fresh item starts from: sampled field values, and
  *  for a visual item `$settings` = the section's settings defaults with the
  *  sample's settings values on top. Unsampled fields stay absent. */
@@ -21,56 +20,3 @@ export function initialGlobalFields(item, settingsDescriptors) {
     }
     return out;
 }
-export async function ensureGlobalItems(entries, config) {
-    const { default: def, supported } = config.locales;
-    const out = {};
-    for (const item of config.registry.globals ?? []) {
-        let [record] = await entries.list(item.name);
-        if (!record) {
-            try {
-                const settings = item.section !== undefined ? sectionSettings(config, item.section) : {};
-                record = await entries.create(item.name, initialGlobalFields(item, settings), { locale: def });
-            }
-            catch (e) {
-                const message = e instanceof Error ? e.message : String(e);
-                // Another admin load won the create: read theirs. Anything else is
-                // worth saying out loud, and must not take the other items down.
-                if (message.includes("it is a singleton"))
-                    [record] = await entries.list(item.name);
-                else
-                    console.warn(`smoodly: could not materialize global item "${item.name}": ${message}`);
-                if (!record)
-                    continue;
-            }
-        }
-        for (const locale of supported) {
-            if (record.locales[locale])
-                continue;
-            try {
-                record = await entries.addLocale(item.name, record.id, locale, { from: def });
-            }
-            catch (e) {
-                const message = e instanceof Error ? e.message : String(e);
-                if (!message.includes("already exists in locale")) {
-                    console.warn(`smoodly: could not materialize global item "${item.name}" in "${locale}": ${message}`);
-                }
-            }
-        }
-        // Every global item is versioned (decided 2026-09-13). A row published before that has
-        // no pointers, so its next save would go live: publish it once more here, which snapshots
-        // what is live and points both pointers at it. Idempotent — pointed rows are skipped.
-        for (const locale of supported) {
-            const row = record.locales[locale];
-            if (!row || row.status !== "published" || row.publishedVersionId !== null)
-                continue;
-            try {
-                record = await entries.setStatus(item.name, record.id, locale, "published");
-            }
-            catch (e) {
-                console.warn(`smoodly: could not version global item "${item.name}" in "${locale}": ${e instanceof Error ? e.message : String(e)}`);
-            }
-        }
-        out[item.name] = record;
-    }
-    return out;
-}

package/dist/admin/handler.d.ts

@@ -1,44 +1,38 @@
-import type { AssetStore } from "../asset-store.ts";
 import type { ResolvedConfig } from "../config.ts";
-import type { EntryStore } from "../entry-store.ts";
 import type { PresenceConfig } from "../env.ts";
-import type { MemberStore } from "../member-store.ts";
-import type { PageStore } from "../store.ts";
-import type { Projector } from "../project.ts";
-import { type AdminAuth } from "./auth.ts";
+import { type KeySet } from "../signed-message.ts";
 import { type AdminFiles } from "./files.ts";
-import { type AdminEffects, type DeployDeps } from "./ops-impl.ts";
-import type { AuthConfig } from "./auth-config.ts";
+import type { AdminEffects } from "./ops.ts";
+import type { SignInConfig } from "./auth-config.ts";
 export type AdminHandlerDeps = {
     config: ResolvedConfig;
-    pages: PageStore;
-    entries: EntryStore;
-    /** The server gate: verifies a session token and reads the member's role. */
-    auth: AdminAuth;
-    /** What the browser needs to sign in: public values only. */
-    signIn: AuthConfig;
-    href?: (path: string, locale: string) => string;
-    /** The media library; without it the assets ops answer "no media store". */
-    assets?: AssetStore;
-    /** The admission table; without it members.list answers "no member store". */
-    members?: MemberStore;
-    /** The site's `site.projector`: a publish writes the delivery rows before it expires the cache. */
-    projector: Projector;
-    /** The content project's public config for editing presence; absent or failed, presence is off. */
+    /** Where the browser sends a person to sign in, and the dashboard it links to: public values only. Absent, the page
+     *  asks Smoodly's API (`GET /v1/auth`, spec 2026-10-16 sign-in and the dashboard §4) once per process and API
+     *  address. */
+    signIn?: SignInConfig;
+    /** Test seam for the sign-in fetch; default the global fetch. */
+    fetch?: typeof fetch;
+    /** Smoodly's API: the admin posts its operations to `${apiUrl}/v1/spaces/${spaceId}/admin/op`. */
+    apiUrl: string;
+    /** The site's space (SMOODLY_SPACE_ID): the service's admin routes live under it. */
+    spaceId: string;
+    /** The service's public signing keys; default the set published at `${apiUrl}/v1/signing-keys`, fetched once per
+     *  process. The revalidate call and the preview grant are verified against it. */
+    keys?: KeySet;
+    /** Where the browser opens the editing-presence socket; absent or failed, presence is off. */
     presence?: () => PresenceConfig | Promise<PresenceConfig>;
     effects?: AdminEffects;
     /** Where drafts are served, when not at the page's own address (page-data.ts). */
     previewBase?: string;
-    /** Static mode (spec 2026-10-09): the deploy operations' deps and the mode the page data names; absent = live. */
-    deploy?: DeployDeps & {
-        mode: "live" | "static";
-    };
+    /** How the canvas marks its draft render (page-data.ts); the query by default, the path on Next. */
+    canvasMarks?: "path" | "query";
+    /** Static mode (spec 2026-10-09) shows the Deploy tile; absent = live. */
+    delivery?: "live" | "static";
     /** The prebuilt files; default: the ones the package's build wrote. Tests pass their own. */
     files?: AdminFiles;
 };
 /** The request came from a page of this site: its Origin names the host the browser asked for. Behind a
  *  proxy that host is X-Forwarded-Host (the first, when a chain appended more), as in Next's own check for
- *  server actions. No Origin, no operation: every browser sends one with a POST. */
+ *  server actions. No Origin, no preview: every browser sends one with a POST. */
 export declare function sameOrigin(request: Request): boolean;
-/** `deps` is read on every request, so nothing is read at import and a build with no keys succeeds. */
 export declare function createAdminHandler(deps: () => AdminHandlerDeps): (request: Request) => Promise<Response>;

package/dist/admin/handler.js

@@ -1,12 +1,13 @@
 // packages/smoodly/src/admin/handler.ts
-// The admin's whole server face (spec 2026-10-02 astro cloud fit §4), framework-free: a web Request in, a
+// The admin's whole server face on the site (spec 2026-10-14 §1), framework-free: a web Request in, a
 // Response out. GET under the admin path is the HTML page, GET under the reserved segment is one of the
-// package's files, POST to `<admin path>/_smoodly/op` is an operation — gated by the origin check, then
-// by the session (auth.ts). Each framework's adapter supplies the effects (next/admin-route.ts).
+// package's files, POST to `<admin path>/_smoodly/revalidate` is the service expiring tags after a publish
+// (signed with the service's own key, spec 2026-10-16 the control plane §2), POST to `<admin path>/_smoodly/preview`
+// is the browser posting a draft grant the service signed. Operations run in the service. Each framework's adapter supplies the
+// effects (next/admin-route.ts).
 import { mountMismatch } from "../admin-path.js";
-import { gateAdminOp } from "./auth.js";
+import { fetchedKeySet, verifyMessage } from "../signed-message.js";
 import { loadAdminFiles } from "./files.js";
-import { createAdminOps, runAdminOp } from "./ops-impl.js";
 import { ADMIN_INTERNAL } from "./page-data.js";
 import { adminErrorHtml, adminPageHtml } from "./page.js";
 import { serializeAdminConfig } from "./serialize.js";
@@ -19,7 +20,7 @@ const html = (status, body) => new Response(body, {
 const refused = (code, message) => ({ ok: false, code, message });
 /** The request came from a page of this site: its Origin names the host the browser asked for. Behind a
  *  proxy that host is X-Forwarded-Host (the first, when a chain appended more), as in Next's own check for
- *  server actions. No Origin, no operation: every browser sends one with a POST. */
+ *  server actions. No Origin, no preview: every browser sends one with a POST. */
 export function sameOrigin(request) {
     return originOf(request).same;
 }
@@ -34,16 +35,76 @@ function originOf(request) {
     catch { /* not a URL: not the same */ }
     return { same, origin, host };
 }
-/** An operation's body: a whole page draft fits many times over; more than this is not an operation. */
-const MAX_BODY_BYTES = 4 * 1024 * 1024;
-/** The session token: `Authorization: Bearer <three dot-separated parts>`. Anything else is no token, so
- *  junk never costs a call to the auth project. */
-function bearer(request) {
-    const match = /^Bearer ([\w-]+\.[\w-]+\.[\w-]+)$/.exec(request.headers.get("authorization") ?? "");
-    return match ? match[1] : null;
+/** The two routes' bodies: a tag list or a grant. Both are read before anything proves who sent them (the
+ *  signature covers the body), so the size is the first gate: a declared length above it is refused unread,
+ *  and a stream without one is cut off when it passes it. */
+const MAX_ROUTE_BODY_BYTES = 256 * 1024;
+const tooLarge = () => json(413, refused("validation", "smoodly: the call is larger than 256 KB."));
+async function cappedText(request) {
+    if (Number(request.headers.get("content-length") ?? 0) > MAX_ROUTE_BODY_BYTES)
+        return null;
+    if (!request.body)
+        return "";
+    const reader = request.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > MAX_ROUTE_BODY_BYTES) {
+            await reader.cancel();
+            return null;
+        }
+        chunks.push(value);
+    }
+    const bytes = new Uint8Array(size);
+    let at = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return new TextDecoder().decode(bytes);
 }
 const decode = (base64) => Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+/** Where editors sign in, from the service, per fetch function and API address: one answer kept for the process, and a
+ *  failure forgotten so the next page asks again. */
+const signIns = new WeakMap();
+const isSignIn = (v) => typeof v === "object" && v !== null && typeof v.signInUrl === "string" && typeof v.consoleUrl === "string";
+function signInOf(d) {
+    const doFetch = d.fetch ?? fetch;
+    let byApi = signIns.get(doFetch);
+    if (!byApi)
+        signIns.set(doFetch, (byApi = new Map()));
+    const apiUrl = d.apiUrl.replace(/\/+$/, "");
+    let asked = byApi.get(apiUrl);
+    if (!asked) {
+        asked = (async () => {
+            const res = await doFetch(`${apiUrl}/v1/auth`, { headers: { accept: "application/json" } });
+            const body = (await res.json().catch(() => null));
+            if (!res.ok || !body?.ok || !isSignIn(body.data))
+                throw new Error(`${apiUrl}/v1/auth answered ${res.status} with no sign-in address`);
+            return { signInUrl: body.data.signInUrl, consoleUrl: body.data.consoleUrl };
+        })();
+        byApi.set(apiUrl, asked);
+        asked.catch(() => byApi.delete(apiUrl));
+    }
+    return asked;
+}
 /** `deps` is read on every request, so nothing is read at import and a build with no keys succeeds. */
+/** The published key set per API address, so a process fetches it once whatever builds the deps per request. */
+const keySets = new Map();
+const keysOf = (d) => {
+    if (d.keys)
+        return d.keys;
+    let set = keySets.get(d.apiUrl);
+    if (!set) {
+        set = fetchedKeySet(d.apiUrl);
+        keySets.set(d.apiUrl, set);
+    }
+    return set;
+};
 export function createAdminHandler(deps) {
     const registries = new WeakMap();
     const registryOf = (config) => {
@@ -63,8 +124,7 @@ export function createAdminHandler(deps) {
         const mismatch = mountMismatch(pathname, base);
         if (mismatch)
             return html(500, adminErrorHtml(mismatch));
-        // A failed lookup (an unmigrated project, an unreachable database) is logged and turns presence off,
-        // so the shell still reaches sign-in and the schema notice.
+        // A glue that throws (a missing env value) is logged and turns presence off, so the shell still reaches sign-in.
         let presence = null;
         try {
             presence = (await d.presence?.()) ?? null;
@@ -72,15 +132,28 @@ export function createAdminHandler(deps) {
         catch (e) {
             console.error("smoodly: editing presence is off —", e instanceof Error ? e.message : e);
         }
+        let signIn;
+        try {
+            signIn = d.signIn ?? (await signInOf(d));
+        }
+        catch (e) {
+            const message = `smoodly: the admin could not reach Smoodly's API for its sign-in values — ${e instanceof Error ? e.message : String(e)}`;
+            console.error(message);
+            return html(500, adminErrorHtml(message));
+        }
         const files = d.files ?? (await loadAdminFiles());
         const data = {
             registry: registryOf(d.config),
-            auth: d.signIn,
+            signIn,
+            apiUrl: d.apiUrl.replace(/\/+$/, ""),
+            spaceId: d.spaceId,
             presence,
-            opUrl: `${base}/${ADMIN_INTERNAL}/op`,
+            opUrl: `${d.apiUrl.replace(/\/+$/, "")}/v1/spaces/${encodeURIComponent(d.spaceId)}/admin/op`,
+            previewUrl: `${base}/${ADMIN_INTERNAL}/preview`,
             filesBase: `${base}/${ADMIN_INTERNAL}/${files.hash}`,
             previewBase: d.previewBase ?? "",
-            delivery: d.deploy?.mode ?? "live",
+            canvasMarks: d.canvasMarks ?? "query",
+            delivery: d.delivery ?? "live",
         };
         return html(200, adminPageHtml(data));
     }
@@ -100,37 +173,59 @@ export function createAdminHandler(deps) {
             },
         });
     }
-    /** The order is the defence: the origin, then the token, then the size, then the session — and only a
-     *  member's body is read and parsed. */
-    async function op(request, d) {
+    /** The service, after a publish: which tags to expire. The signature is the only admission (no origin:
+     *  it is server to server), and the window keeps a captured call from being replayed. */
+    async function revalidate(request, d) {
+        const body = await cappedText(request);
+        if (body === null)
+            return tooLarge();
+        const h = request.headers;
+        const signed = { ts: Number(h.get("x-smoodly-timestamp")), kid: h.get("x-smoodly-key-id") ?? "", sig: h.get("x-smoodly-signature") ?? "" };
+        // The message is verified for the site's own space: a call signed for another names another space and fails.
+        const space = h.get("x-smoodly-space");
+        if ((space !== null && space !== d.spaceId) || !(await verifyMessage(keysOf(d), "revalidate", d.spaceId, body, signed))) {
+            return json(401, refused("unauthorized", "smoodly: the revalidate call is not signed by Smoodly's current key, for another space, or older than a minute."));
+        }
+        let tags;
+        try {
+            tags = JSON.parse(body).tags;
+        }
+        catch {
+            return json(400, refused("validation", "smoodly: the revalidate call was not JSON."));
+        }
+        if (!Array.isArray(tags) || !tags.every((t) => typeof t === "string"))
+            return json(400, refused("validation", "smoodly: the revalidate call needs `tags`, a list of strings."));
+        for (const tag of tags)
+            await d.effects?.revalidate?.(tag);
+        return json(200, { ok: true, data: { expired: tags.length } });
+    }
+    /** The browser, holding a grant the service signed: the draft cookie is set on the site's own origin,
+     *  so the origin check comes first and the grant second. */
+    async function preview(request, d) {
         const from = originOf(request);
-        if (!from.same) {
-            return json(403, refused("unauthorized", `smoodly: operations are accepted from the site's own address only — this request's Origin is ${String(from.origin).slice(0, 200)} and the server was asked at ${from.host}. Behind a proxy, pass the Host header through or set X-Forwarded-Host.`));
+        if (!from.same)
+            return json(403, refused("unauthorized", `smoodly: the preview route is called from the site's own address only — this request's Origin is ${String(from.origin).slice(0, 200)}.`));
+        const text = await cappedText(request);
+        if (text === null)
+            return tooLarge();
+        let sent;
+        try {
+            sent = JSON.parse(text);
         }
-        const token = bearer(request);
-        if (!token)
-            return json(401, refused("unauthorized", "smoodly: sign in to use the admin."));
-        if (Number(request.headers.get("content-length") ?? 0) > MAX_BODY_BYTES) {
-            return json(413, refused("validation", "smoodly: the operation is larger than 4 MB."));
+        catch {
+            return json(400, refused("validation", "smoodly: the preview call was not JSON."));
         }
-        const base = { config: d.config, pages: d.pages, entries: d.entries, href: d.href, assets: d.assets, members: d.members, projector: d.projector, effects: d.effects, deploy: d.deploy };
-        let status = 200;
-        // The gate needs the token alone; the call is read once it has admitted the session.
-        const result = await gateAdminOp(d.auth, { path: "", args: [], token }, async (_gate, session) => {
-            let body;
-            try {
-                body = await request.json();
-            }
-            catch {
-                status = 400;
-                return refused("validation", "smoodly: the operation was not JSON.");
-            }
-            // The token is the header's alone: a `token` in the body is dropped here.
-            const sent = typeof body === "object" && body !== null && !Array.isArray(body) ? body : {};
-            // Ops are built per call so the verified session rides into every store write as `by` (spec 2026-09-13 history §2).
-            return runAdminOp(createAdminOps({ ...base, actor: session }), { path: sent.path, args: sent.args });
-        });
-        return json(!result.ok && result.code === "unauthorized" ? 401 : status, result);
+        const action = sent.action === "enable" || sent.action === "disable" ? sent.action : null;
+        const grant = sent.grant;
+        const ok = action !== null && grant?.space === d.spaceId
+            && (await verifyMessage(keysOf(d), "preview", d.spaceId, action, { ts: Number(grant?.ts), kid: String(grant?.kid ?? ""), sig: String(grant?.sig ?? "") }));
+        if (!ok)
+            return json(401, refused("unauthorized", "smoodly: the preview grant is missing, for another action, or older than a minute — open the page again."));
+        if (action === "enable")
+            await d.effects?.draft?.enable();
+        else
+            await d.effects?.draft?.disable();
+        return json(200, { ok: true, data: null });
     }
     return async function handle(request) {
         try {
@@ -139,7 +234,11 @@ export function createAdminHandler(deps) {
             const internal = `${d.config.admin.path}/${ADMIN_INTERNAL}/`;
             const method = request.method.toUpperCase();
             if (method === "POST") {
-                return pathname === `${internal}op` ? await op(request, d) : json(404, refused("not_found", "smoodly: operations are posted to the admin's endpoint."));
+                if (pathname === `${internal}revalidate`)
+                    return await revalidate(request, d);
+                if (pathname === `${internal}preview`)
+                    return await preview(request, d);
+                return json(404, refused("not_found", "smoodly: the admin mount serves the page, its files, the revalidate call and the preview grant; operations go to the service."));
             }
             if (method !== "GET" && method !== "HEAD")
                 return new Response(null, { status: 405, headers: { allow: "GET, HEAD, POST" } });

package/dist/admin/health.d.ts

@@ -13,15 +13,11 @@ export type HealthDocument = {
     collection: string | null;
     findings: HealthFinding[];
 };
-import type { DeliveryStatus } from "../project.ts";
-/** `delivery` (DESIGN §3, the document stamp): the delivery rows behind the current stamp, with the recorded one;
- *  absent only in a report built without a projector (static tests). */
 export type HealthReport = {
     documents: HealthDocument[];
     collections: {
         name: string;
         count: number;
     }[];
-    delivery?: DeliveryStatus;
 };
 export declare function buildHealthReport(registry: AdminRegistry, pages: PageScan[], entries: EntryScan[]): HealthReport;

package/dist/admin/index.d.ts

@@ -1,15 +1,12 @@
-export type { AdminOps, AdminOpCall, AdminOpAction, OpResult, OpError, PageCreateInput, PageGetResult, GlobalListItem, GlobalGetResult, AssetUsageItem, MembersListResult } from "./ops.ts";
+export type { AdminEffects, AdminOps, AdminOpCall, AdminOpAction, OpResult, OpError, PageCreateInput, PageGetResult, GlobalListItem, GlobalGetResult, AssetUsageItem, MembersListResult } from "./ops.ts";
 export type { InviteInput, InviteResult, MemberRecord } from "../member-store.ts";
 export type { MemberRole } from "../permissions.ts";
-export { createAdminOps, runAdminOp, type AdminEffects } from "./ops-impl.ts";
-export { fixedNodeSpecs, fixedNodeOf, ensureFixedNodes, type FixedNode } from "./fixed-nodes.ts";
-export { ensureGlobalItems, initialGlobalFields } from "./global-items.ts";
+export { fixedNodeSpecs, fixedNodeOf, type FixedNode } from "./fixed-nodes.ts";
+export { initialGlobalFields } from "./global-items.ts";
 export { makeClientOps } from "./client-ops.ts";
-export { gateAdminOp, type AdminAuth } from "./auth.ts";
-export { supabaseAdminAuth } from "./supabase-auth.ts";
-export type { AuthConfig } from "./auth-config.ts";
+export type { SignInConfig } from "./auth-config.ts";
 export { serializeAdminConfig } from "./serialize.ts";
 export type { AdminRegistry, AdminSection, AdminCollection, AdminPageTemplate, AdminGlobal, AdminField } from "./serialize.ts";
 export * from "./tree-ops.ts";
 export { validateFields, type FieldError } from "./validate.ts";
-export { createSmoodlyContent, SmoodlyContentError, type SmoodlyContent, type ContentDeps } from "../content/content-api.ts";
+export { apiTransport, createSmoodlyContent, SmoodlyContentError, type SmoodlyContent, type ContentDeps, type ContentTransport } from "../content/content-api.ts";

package/dist/admin/index.js

@@ -1,10 +1,7 @@
-export { createAdminOps, runAdminOp } from "./ops-impl.js";
-export { fixedNodeSpecs, fixedNodeOf, ensureFixedNodes } from "./fixed-nodes.js";
-export { ensureGlobalItems, initialGlobalFields } from "./global-items.js";
+export { fixedNodeSpecs, fixedNodeOf } from "./fixed-nodes.js";
+export { initialGlobalFields } from "./global-items.js";
 export { makeClientOps } from "./client-ops.js";
-export { gateAdminOp } from "./auth.js";
-export { supabaseAdminAuth } from "./supabase-auth.js";
 export { serializeAdminConfig } from "./serialize.js";
 export * from "./tree-ops.js";
 export { validateFields } from "./validate.js";
-export { createSmoodlyContent, SmoodlyContentError } from "../content/content-api.js";
+export { apiTransport, createSmoodlyContent, SmoodlyContentError } from "../content/content-api.js";